Answers for "Sum of conditional if with wildcard"
https://answers.splunk.com/answers/314046/sum-of-conditional-if-with-wildcard.html
The latest answers for the question "Sum of conditional if with wildcard"Answer by maciep
https://answers.splunk.com/answering/314205/view.html
something like this?
... | stats count(eval(type1_if=1)) as type1_if count(eval(type2_if=1)) as type2_if count(eval(type1_if=1 OR type2_if=1)) as type_if by _timestamp userFri, 02 Oct 2015 16:31:45 GMTmaciepAnswer by woodcock
https://answers.splunk.com/answering/314050/view.html
I think you are not asking for what you really desire but assuming I am incorrect, you can what you asked like this:
event="standard"
| regex _raw!=(?i)"(fileofinterest.txt|objectofinterest.txt|otherthing.bat)"
| stats count(eval(match(InterestingField,"%fileofinterest.txt%") AS type1_if_total
count(eval(match(InterestingField, "%objectofinterest.txt%") AS type2_if_total BY _timestamp user
| eval type_if_total = type1_if_total + type2_if_totalThu, 01 Oct 2015 20:24:17 GMTwoodcock